1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-03 05:10:03 +02:00
Commit Graph

17 Commits

Author SHA1 Message Date
Michael Niedermayer
ef3b42738b
avcodec/evc_ps: Check chroma_format_idc
Fixes: out of array access
Fixes: 62678/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4858264984354816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kieran Kunhya <kierank@obe.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-10-16 00:54:37 +02:00
Andreas Rheinhardt
378f1b6a39 avcodec/evc_ps: Fix leak on error
Regression since 4565747056.
Fixes Coverity ticket #1545072.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2023-09-26 20:41:55 +02:00
Michael Niedermayer
120f74650d
avcodec/evc_ps: Check cpb_cnt_minus1 and propagate error
Fixes: out of array access
Fixes: 60949/clusterfuzz-testcase-minimized-ffmpeg_dem_EVC_fuzzer-5959738853294080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-09-22 23:47:39 +02:00
James Almer
156f53e987 avcodec/evc_ps: make the sps parameter in ref_pic_list_struct const
It's not changed.

Signed-off-by: James Almer <jamrial@gmail.com>
2023-09-15 16:33:13 -03:00
Michael Niedermayer
4565747056
avcodec/evc_ps: Check ref_pic_num and sps_max_dec_pic_buffering_minus1
Fixes: out of array write

Found-by: dongsookim@korea.ac.kr
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-09-15 17:13:54 +02:00
Michael Niedermayer
cf9cd35aa9
avcodec/evc_ps: Check num_ref_pic_list_in_sps
Fixes: out of array write
Fixes: 60798/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-4633529766772736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-07-28 02:12:12 +02:00
Andreas Rheinhardt
6e5e74c55b avcodec/evc*: Improve included headers
In particular, don't include avcodec.h in evc_frame_merge_bsf.c.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2023-07-24 10:37:07 +02:00
Andreas Rheinhardt
915701939c avcodec/evc_ps: Replace av_malloc+memset by av_mallocz
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2023-06-30 00:49:11 +02:00
James Almer
ffe4ec5c84 avcodec/evc_ps: fix allowed range for pps_pic_parameter_set_id
Signed-off-by: James Almer <jamrial@gmail.com>
2023-06-23 09:39:14 -03:00
James Almer
7347b44224 avcodec/evc_ps: use unsigned types in structs where corresponds
Signed-off-by: James Almer <jamrial@gmail.com>
2023-06-23 08:37:23 -03:00
James Almer
2212808a72 avcodec/evc_ps: pass a GetBitContext to the SPS and PPS parsing functions
This is in preparation for the following patch.

Signed-off-by: James Almer <jamrial@gmail.com>
2023-06-21 13:31:14 -03:00
James Almer
5b372c7ff2 avcodec/evc_ps: use get_bits1() where useful
Signed-off-by: James Almer <jamrial@gmail.com>
2023-06-19 19:43:12 -03:00
James Almer
377da83b99 avcodec/evc_ps: check valid range for a few more elements
Should prevent overreads on non spec comformant input.

Signed-off-by: James Almer <jamrial@gmail.com>
2023-06-19 17:21:14 -03:00
James Almer
199fc04d09 avcodec/evc_ps: use get_bits_long() where needed
Signed-off-by: James Almer <jamrial@gmail.com>
2023-06-19 16:25:13 -03:00
Michael Niedermayer
89f98acbf8 avcodec/evc_ps: Check log2_sub_gop_length
Fixes: 1.70141e+38 is outside the range of representable values of type 'int'
Fixes: 59883/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-5557887217565696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
2023-06-19 16:00:55 -03:00
James Almer
921596e677 avcodec/evc_ps: make ff_evc_parse_{sps,pps} return an error code
Signed-off-by: James Almer <jamrial@gmail.com>
2023-06-19 16:00:55 -03:00
James Almer
1e189fed7a avcodec/evc_parse: split off Parameter Set parsing into its own file
Signed-off-by: James Almer <jamrial@gmail.com>
2023-06-19 12:57:31 -03:00